MALICIOUS
104
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains an embedded URI pointing to a suspicious domain, and ClamAV detected it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure for downloading a PDF. The presence of external URIs and the ML classifier's high confidence score indicate a malicious intent to trick the user into downloading further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/award?keyword=april+2020+current+affairs+pdf+free+download
- http://rulajamizap.getenjoyment.net/soneweregurodi.pdf
- https://static.s123-cdn-static.com/uploads/4415530/normal_5fedd481e5f0b.pdf
- http://tujijamutibe.sportsontheweb.net/76022055678.pdf
- http://binadof.iblogger.org/bomag_compaction_guide.pdf
- http://pelabinowoguk.getenjoyment.net/95363083821.pdf
- https://cdn-cms.f-static.net/uploads/4497110/normal_60473adf4e881.pdf
- http://sowivonowiso.iblogger.org/kmspico_windows_10_pro_64_bit.pdf
- https://static.s123-cdn-static.com/uploads/4403271/normal_5ff4f8e0abdd1.pdf
- http://tinubovibiwiwi.iblogger.org/reduced_university_fees_coronavirus.pdf
- http://gaxesujite.medianewsonline.com/fomivubekawivedenapesetev.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://zusobowes.rf.gd/78763231426.pdf
- http://werewipabelud.rf.gd/32018986886.pdf
- http://nebojemesiwi.atwebpages.com/bali_itinerary_4_days.pdf
- https://8b83d164-5e56-46cc-b941-48f48810ddf3.filesusr.com/ugd/76ce43_721cdc5af746483b9e9bd9bfbab0176a.pdf?index=true
- https://ddf64d59-5240-4154-9987-17dfc28e22c7.filesusr.com/ugd/cec570_ef83c41c825e41199d58a671fe1c9659.pdf?index=true
- http://ruxuwidoke.epizy.com/worksheet_food_english.pdf
- http://susabumo.atwebpages.com/vezetojamufisepum.pdf
- http://juvusowupu.onlinewebshop.net/75466042682.pdf
- http://mevomum.epizy.com/how_to_use_black_and_decker_microwave.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010fe7.bin3ba64263bc16d05cd5b06daee93131537c0458d89bca3d436e32ff61e59c2694 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10FE7 | 5504 bytes |
font_01_sfnt_off000122c2.binbe56be2d25ce2259b65c4e74877287b60dca883cbfb624ae8102aeb6830fec87 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x122C2 | 11476 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.